Privacy policy

1. Data controller

PSAR, a French limited liability company trading as AVS Technologies, 14 rue Joliot-Curie, ZI du Pommeret, 76650 Petit-Couronne, France.

Contact: [email protected]

2. Data collected

• Account: email address, username, display name, avatar (optional), password, creation date.
• Gameplay: matches, scores, statistics, devices linked to your account.
• Technical: server logs (IP address, browser type, timestamp), for security and diagnostics.

Passwords are never stored in plain text: only a hashed fingerprint is kept.

Pangshot uses no analytics tool and no advertising tracker.

3. Cookies and local storage

The website sets no advertising or analytics cookies. No consent banner is therefore required.

• A language cookie remembers your chosen language.
• Your theme (light or dark) and your session tokens are stored in your browser (localStorage), not in cookies.
• The Cloudflare Turnstile anti-bot widget, used on sign-up and password reset, may store technical data needed to detect bots.

4. Purposes and legal bases

• Providing the service (account, statistics, history): performance of the contract formed by the terms of use.
• Service security and abuse prevention, in particular via Cloudflare Turnstile: legitimate interest.
• Account-related emails, such as password reset: performance of the contract.

5. Data that is public

Pangshot is built around public profiles: username, display name, avatar, statistics and match history are publicly accessible without an account, and may be indexed by search engines.

Your email address is never made public.

6. Recipients and processors

Your data is neither sold nor transferred. It is processed on our behalf by the following providers:

• OVH SAS — hosting of the website and database.
• Cloudflare, Inc. — website delivery, abuse protection and the Turnstile widget. This provider is established outside the European Union: transfers are covered by the European Commission's standard contractual clauses.
• Resend — sending account-related emails.

7. Retention periods

• Account, profile, matches and statistics: kept for as long as the account exists.
• After a deletion request: purged within 30 days, once backups have rotated.
• Technical logs: 12 months.

8. Your rights

Under the GDPR, you have rights of access, rectification, erasure, restriction, objection and portability.

These rights are exercised by writing to [email protected]. We respond within one month.

Account deletion is not yet possible directly from the website: it is done on request at that address.

9. Complaints

If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority, the CNIL: cnil.fr

10. Security

Traffic to the website and the API is encrypted (HTTPS). Passwords are hashed. Session tokens are short-lived and renewed automatically.

11. Minors

The service is intended for people aged 15 or over. Below that age, the consent of a parent or legal guardian is required.

12. Changes

This policy may change. The last updated date appears at the top of the page.